|
 |
055396 |
diff -up netkit-telnet-0.17/telnetd/utility.c.orig netkit-telnet-0.17/telnetd/utility.c
|
|
|
055396 |
--- netkit-telnet-0.17/telnetd/utility.c.orig 2020-03-25 11:53:56.772624325 +0100
|
|
|
055396 |
+++ netkit-telnet-0.17/telnetd/utility.c 2020-03-25 11:54:01.966601415 +0100
|
|
|
055396 |
@@ -221,31 +221,38 @@ void ptyflush(void)
|
|
|
055396 |
*/
|
|
|
055396 |
static
|
|
|
055396 |
char *
|
|
|
055396 |
-nextitem(char *current)
|
|
|
055396 |
+nextitem(char *current, const char *endp)
|
|
|
055396 |
{
|
|
|
055396 |
+ if (current >= endp) {
|
|
|
055396 |
+ return NULL;
|
|
|
055396 |
+ }
|
|
|
055396 |
if ((*current&0xff) != IAC) {
|
|
|
055396 |
return current+1;
|
|
|
055396 |
}
|
|
|
055396 |
+ if (current+1 >= endp) {
|
|
|
055396 |
+ return NULL;
|
|
|
055396 |
+ }
|
|
|
055396 |
switch (*(current+1)&0xff) {
|
|
|
055396 |
case DO:
|
|
|
055396 |
case DONT:
|
|
|
055396 |
case WILL:
|
|
|
055396 |
case WONT:
|
|
|
055396 |
- return current+3;
|
|
|
055396 |
+ return current+3 <= endp ? current+3 : NULL;
|
|
|
055396 |
case SB: /* loop forever looking for the SE */
|
|
|
055396 |
{
|
|
|
055396 |
register char *look = current+2;
|
|
|
055396 |
|
|
|
055396 |
- for (;;) {
|
|
|
055396 |
+ while (look < endp) {
|
|
|
055396 |
if ((*look++&0xff) == IAC) {
|
|
|
055396 |
- if ((*look++&0xff) == SE) {
|
|
|
055396 |
+ if (look < endp && (*look++&0xff) == SE) {
|
|
|
055396 |
return look;
|
|
|
055396 |
}
|
|
|
055396 |
}
|
|
|
055396 |
}
|
|
|
055396 |
+ return NULL;
|
|
|
055396 |
}
|
|
|
055396 |
default:
|
|
|
055396 |
- return current+2;
|
|
|
055396 |
+ return current+2 <= endp ? current+2 : NULL;
|
|
|
055396 |
}
|
|
|
055396 |
} /* end of nextitem */
|
|
|
055396 |
|
|
|
055396 |
@@ -271,7 +278,7 @@ void netclear(void)
|
|
|
055396 |
register char *thisitem, *next;
|
|
|
055396 |
char *good;
|
|
|
055396 |
#define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \
|
|
|
055396 |
- ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
|
|
|
055396 |
+ (nfrontp > p+1 && (((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))))
|
|
|
055396 |
|
|
|
055396 |
#if defined(ENCRYPT)
|
|
|
055396 |
thisitem = nclearto > netobuf ? nclearto : netobuf;
|
|
|
055396 |
@@ -279,7 +286,7 @@ void netclear(void)
|
|
|
055396 |
thisitem = netobuf;
|
|
|
055396 |
#endif
|
|
|
055396 |
|
|
|
055396 |
- while ((next = nextitem(thisitem)) <= nbackp) {
|
|
|
055396 |
+ while ((next = nextitem(thisitem, nbackp)) != NULL && next <= nbackp) {
|
|
|
055396 |
thisitem = next;
|
|
|
055396 |
}
|
|
|
055396 |
|
|
|
055396 |
@@ -291,20 +298,23 @@ void netclear(void)
|
|
|
055396 |
good = netobuf; /* where the good bytes go */
|
|
|
055396 |
#endif
|
|
|
055396 |
|
|
|
055396 |
- while (nfrontp > thisitem) {
|
|
|
055396 |
+ while (thisitem != NULL && nfrontp > thisitem) {
|
|
|
055396 |
if (wewant(thisitem)) {
|
|
|
055396 |
int length;
|
|
|
055396 |
|
|
|
055396 |
next = thisitem;
|
|
|
055396 |
do {
|
|
|
055396 |
- next = nextitem(next);
|
|
|
055396 |
- } while (wewant(next) && (nfrontp > next));
|
|
|
055396 |
+ next = nextitem(next, nfrontp);
|
|
|
055396 |
+ } while (next != NULL && wewant(next) && (nfrontp > next));
|
|
|
055396 |
+ if (next == NULL) {
|
|
|
055396 |
+ next = nfrontp;
|
|
|
055396 |
+ }
|
|
|
055396 |
length = next-thisitem;
|
|
|
055396 |
bcopy(thisitem, good, length);
|
|
|
055396 |
good += length;
|
|
|
055396 |
thisitem = next;
|
|
|
055396 |
} else {
|
|
|
055396 |
- thisitem = nextitem(thisitem);
|
|
|
055396 |
+ thisitem = nextitem(thisitem, nfrontp);
|
|
|
055396 |
}
|
|
|
055396 |
}
|